CVE-2026-22600
Published: 10 January 2026
Summary
CVE-2026-22600 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Openproject Openproject. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 19.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-22600 is a Local File Read (LFR) vulnerability (CWE-200) in OpenProject, an open-source web-based project management software, affecting versions prior to 16.6.4. The flaw resides in the work package PDF export functionality, where the backend image processing engine, ImageMagick, can be exploited. By uploading a specially crafted SVG file disguised as a PNG as a work package attachment, an attacker triggers the ImageMagick text: coder during image resizing in the PDF export process. This has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).
An authenticated attacker with permissions to upload attachments to a container exportable to PDF, such as a work package, can exploit this vulnerability. Upon PDF export of the work package, the malicious image causes ImageMagick to disclose arbitrary local files accessible to the application user, including sensitive data like /etc/passwd, all project configuration files, and private project data.
The issue has been addressed in OpenProject version 16.6.4. Administrators unable to upgrade immediately may apply the patch manually. Mitigation details are available in the official release notes at https://github.com/opf/openproject/releases/tag/v16.6.4 and the security advisory at https://github.com/opf/openproject/security/advisories/GHSA-m8f2-cwpq-vvhh.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1887
Vulnerability details
OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as…
more
a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local file read via crafted image in PDF export enables arbitrary file access on the local system (e.g., /etc/passwd, configs).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by applying the vendor patch released in OpenProject version 16.6.4 to fix the ImageMagick exploitation during PDF export.
Validates content and type of uploaded attachments to block specially crafted SVG files disguised as PNGs before they reach the PDF export processing.
Enforces secure configuration settings in ImageMagick, such as disabling the vulnerable 'text:' coder, to prevent local file read during image resizing in PDF generation.